Loading story…
Check Point issued emergency updates for two critical vulnerabilities, CVE-2026-85102 and CVE-2026-85103, affecting Quantum Security Gateways, Security Management systems, Spark Firewalls, and Remote Access and Site-to-Site VPN deployments. An unauthenticated attacker could exploit flaws in certificate handling during VPN negotiation to execute arbitrary code on exposed perimeter appliances; CVE-2026-85102 involves improper certificate validation and authentication bypass, while CVE-2026-85103 is a heap overflow in ASN.1 certificate decoding.
Check Point has provided fixes through LivePatch and Jumbo Hotfix Accumulator packages. Organizations should apply available updates promptly and, where patching is delayed, reduce VPN exposure using implied-rule and UDP-port controls. No public proof-of-concept exploit was reported at disclosure, but internet-facing VPN infrastructure is a high-priority remediation target.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-902 covering CVE-2026-85102, an authentication-bypass and remote-code-execution issue in Remote Access and Site-to-Site VPN, and CVE-2026-85103, an ASN.1-decoding heap overflow that can lead to remote code execution. The advisory identified affected Check Point Security Gateway, Spark Firewall, and Security Management Server products and urged administrators to apply available updates.
Check Point released emergency updates for CVE-2026-85102 and CVE-2026-85103, which affect VPN certificate processing in Quantum Security Gateway, Security Management, and Spark Firewall products. The fixes were provided through LivePatch and Jumbo Hotfix Accumulator packages; both flaws can permit unauthenticated remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcelabs.beazley.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point disclosed that its remote access VPN solutions had been targeted in ongoing attacks and later confirmed the activity was tied to **CVE-2024-24919**, a vulnerability affecting multiple **Quantum Gateway** product lines. The flaw can allow unauthorized reading of certain firewall device information when **VPN** or **Mobile Access** functionality is enabled, and early observed exploitation involved older local accounts that still used password-only authentication. Check Point released a hotfix after updating its advisory, but external researchers said the issue was more severe than first described, that exploitation was relatively simple, and that a proof-of-concept had been published. Reporting indicated exploitation may have been underway since at least 30 April 2024, prompting urgent guidance for organizations to patch exposed devices immediately, review whether internet-facing systems had already been compromised, and follow Check Point validation and remediation guidance.
Jun 29, 2026
Check Point released security updates to fix multiple vulnerabilities across **Mobile Access**, **SSL VPN**, **Remote Access VPN**, **Spark Firewall**, **Security Gateways**, and **Multi-Domain Security Management**. The most severe flaw, **`CVE-2026-50751`** with a **CVSS 9.3**, is an authentication bypass issue in deprecated **IKEv1** key exchange used for VPN Remote Access and Mobile Access, and Check Point said it is being exploited in the wild as a **zero-day**. The update also addresses **`CVE-2026-50752`**, which affects certificate validation in deprecated **IKEv1** site-to-site VPN connections and could allow **man-in-the-middle** attacks. Across the broader set of flaws, Check Point warned of risks including **denial of service, data manipulation, authentication bypass, and unauthorized access**, and urged organizations to apply patches as soon as testing is complete.
Jul 10, 2026
Check Point disclosed and patched **`CVE-2024-24919`**, a critical information disclosure flaw affecting Internet-connected **Network Security Gateway** devices with **Remote Access VPN** or **Mobile Access** enabled. The vulnerability was traced to improper HTTP `POST` request validation that can enable directory traversal and arbitrary file reads by an unauthenticated attacker, allowing exposure of sensitive data from affected gateways. Check Point said it observed exploitation attempts in the wild, issued an initial mitigation, then released a mandatory hotfix and urged customers to apply it immediately. Reported abuse focused on remote-access environments, particularly older local VPN accounts using password-only authentication. Stolen data may include local account password hashes, private SSH keys, certificates, and potentially Active Directory-related files such as `ntds.dit`, creating follow-on risk of credential theft, lateral movement, broader network intrusion, and possible escalation toward remote code execution. Check Point and external responders advised organizations to disable unused local accounts, enforce stronger authentication such as MFA or certificates, rotate exposed credentials, and review gateway and authentication logs for signs of compromise.
Jul 24, 2026